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Dated: 14" January 2020 
Subject: Compliance Certification Enforcement Update - TCF v1.1 
Dear TCF Vendors and CMPs, 


On 23" December, we wrote to you on the issue of CMPs whom IAB Europe had certified as 
compliant with the TCF v1.1 Policies failing to roll out compliant versions of their user 
interfaces (Uls) on all installations on which they were operating, or engaging in behaviour 
that otherwise violated those Policies (for example, by ignoring choices made by users). We 
noted that implementation of the compliant versions in-market, not just in a staging 
environment, was something that each of the CMPs had committed to as a condition of 
being certified as compliant. Deployment of non-compliant Uls reduces consumer 
protection, places publishers, Vendors and other CMPs in legal jeopardy, and discredits the 
TCF in the eyes of regulators and users. We undertook to come back early in the New Year 
with further information about the enforcement process we would be adopting for those 
CMPs who had not rolled out TCF v1.1-compliant Uls. 


This message is to share with you further information about that enforcement process. The 
process constitutes a targeted response that tries to balance the need to avoid wasting 
scarce resources on enforcing a version of the Framework that is about to be deprecated, on 
the one hand, with the need to protect the integrity and credibility of the standard overall, on 
the other. 


The steps we are taking are as follows: 


1. We will be checking CMP Uls on the top 50 websites by traffic volume in 5-10 
European markets during January for compliance with the TCF v1.1 Policies. 

2. Where we identify breaches of the Policies, we will be sending warning letters to the 
CMPs concerned, giving deadlines of between 7 and 14 days by which the CMPs 
responsible need to address them or face suspension of their CMP IDs. 

3. Where the breaches have not been addressed by the deadline, we will suspend the 
relevant CMP ID and communicate that suspension to the Vendor and CMP 
communities in line with IAB Europe’s prerogatives under the TCF Terms and 
Conditions (available here). Reinstatement will be conditional on the breaches being 
remedied in their totality. 
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We will prioritise two particularly important “behavioural” requirements — the obligation not to 
create a consent string unless there has been user interaction, and the obligation to faithfully 
reflect user choices in the creation of that string — and eight other Policy checks pertaining to 
information disclosures that must be made in the first layer of the CMP UI in order to satisfy 
the requirements of the ePrivacy Directive and GDPR. Breaches of these requirements are 
both the most potentially serious from a consumer protection point of view and the most 
visible for regulatory authorities. 


We count on your good will and support for the duration of this “Phase II” enforcement 
exercise and remain at your disposal for any further information you may require. 


Yours sincerely, 
Townsend Feehan & IAB Europe Team 
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B-1040 Belgium 
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